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METHOD AND COMPUTER SYSTEM FOR OPERATING AT LEAST TWO 
INTERCONNECTED CONTROL UNITS 



Background Inf ormat ion FIELD OF THE INVENTION 

The present invention is directed to a method for operating at 
least two interconnected control units. The control units 
access sensor data and each execute at least one computer 
5 program for controlling operational sequences, in particular 
in a vehicle. The control units exchange synchronization 
information. 

The present invention is also directed to a computer system 
including at least two interconnected control units and a data 

10 transmission medium that connects the control units in order 
to exchange synchronization information among the control 
units. The control units access sensor data and each execute 
at least one computer program for controlling operational 
sequences, in particular in a vehicle. The data transmission 

15 medium may also be used for transmitting pure useful data. The 
transmission of the data itself may be utilized as 
synchronization information. 

BACKGROUND INFORMATION 

From the motor vehicle sector, it is known to use control 
2 0 units to control and/or regulate various operational sequences 
in a motor vehicle. The operational sequences to be controlled 
or regulated include, for example, the operation of an 
internal combustion engine (torque control, speed control, 
injection period control, etc.), of a steer-by-wire system, of 
25 a brake-by-wire system or of other X-by-wire systems, the 
operation of safety-related functions (vehicle-stability 
control systems, antilock systems for the brakes, anti-slip 
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control, active steering systems, active shock absorber 
systems, etc.), as well as comfort and convenience functions 
(air-conditioning, electrical seat adjustment, mirror 
actuation, or steering-wheel adjustment, electrical power- 
5 window control, sliding sunroof, etc.). 

As the complexity of operational sequences to be controlled or 
regulated increases, so does the complexity of the computer 
programs that are run on the control units for carrying out 
the control and, respectively, regulating functions, which 

10 ultimately also leads to higher demands on the control unit 
hardware. In particular, to fulfill the control and, 
respectively, regulating functions, it is necessary to process 
an ever increasing amount of sensor signals that are made 
available by sensors via inputs to the control unit. However, 

15 the number of inputs of one control unit is limited. For that 
reason, to render possible the control and/or regulation of 
advanced, complex operational sequences, the need exists to 
develop and market control units having a larger number of 
inputs. However, it is a complex and cost -intensive process to 

20 develop new control units. Such new developments would make 
available more diverse control units, but would decrease the 
number of individual control units, so that additional costs 
would likewise be entailed for control units. 

However, in the motor vehicle sector, in particular, low costs 
25 and associated standardized components, as well as high piece 
numbers are vitally important to the competitiveness of 
components . 

Today, conventional standard control units already have plugs 
with fewer terminals than would actually be required for 
30 complex operational sequences in motor vehicles. However, for 
the reasons described above, new control units having plugs 
with more terminals will not be made available in the 
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foreseeable future. Thus', it is essential to discover other 
ways for controlling and/or regulating advanced, complex 
operational sequences using standard control units. 

From the information technology sector, it is known to 
5 interlink a plurality of computers (for example, so-called 
PCs, personal computers) via a data- transmission medium to a 
computer system. The data- transmission medium can be a 
wireless link, an optical connection or a wire-based 
connection. Data and information can be transmitted via the 

10 data- transmission medium in accordance with user-defined 
protocols. Various computer programs having different 
functions are run on the computers of such distributed 
computer systems. The sequences on the individual computers 
are coordinated by a higher- level unit or by a computer (so- 

15 called master) of the computer system. For this purpose, it is 
possible for the master to transmit synchronization 
information via the data- transmission medium to the other 
computers (co-called slaves) . The distributed computer systems 
make possible a greater computing capacity with respect to 

2 0 computing power and memory capacity, and they are 

characterized by substantial flexibility. In this context, the 
larger number of inputs and/or outputs of the computer system 
as compared to individual computers is unimportant. Moreover, 
input signals incoming at one computer of the computer system 
25 are not necessarily required at other computers as well and 
are, therefore, also not transmitted by the one computer to 
the remaining computers. This is because various computer 
programs requiring, as a rule, different input signals are run 
on the computers . 

3 0 SUMMARY OF THE INVENTION 

Starting out — from the related art dcocribed at the outset, 
irtlt is, therefore, thc an object of the exempla ry em bodiment 
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and/o r exemplary method of the present invention to dcoign and 
rcf inc provide a computer system in such a way that, with the 
aid of the computer system, even especially complex 
operational sequences, as occur, for example, in a modern 
5 motor vehicle, will also be able to controlled and/or 

regulated simply and cost-effectively using conventional 
control units. 

To achieve this objective, it — ia propoocd on the baoio — of the 
method of the type mentioned at — the outoct described herein is 
10 implemented and used to provide that the control units execute 
the same computer program time -synchronously while using a 
settable time lag. 

Gumma ry of the Invention 

The exemplary embodiment and/or exemplary method of the 

15 present invention provides for a plurality of control units to 
be linked via a data- transmission medium to a computer system. 
In this context, it is less a question of increasing the 
computing capacity than it is of increasing the number of 
available inputs for transmitting sensor data to the control 

20 units. The same computer programs are executed on all of the 
control units; i.e., the control units require the same input 
signals (sensor data) in order to be able perform the 
computations required for fulfilling the control and/or 
regulating function. In accordance with the exemplary 

25 embodiment and/or exemplary method of the present invention, 
however, not all sensor signals are fed via the inputs to all 
of the control units. Rather, the totality of the sensor data 
that is required by the computer programs and that is 
available is distributed among the individual control units of 

3 0 the computer system. The sensor data are then transmitted by 
this control unit via the data- transmission medium to the 
other control units of the computer system to make them 
available there as well. 
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The computer programs in the individual control units are 
executed synchronously, prcf crably which may be time- 
synchronously, i.e., in strictly predefined time slices. 
However, a certain amount of time is required to transmit 
5 sensor data via the data- transmission medium during which the 
sensor data are not yet available in all control units. 
Moreover, the sensor data are not simultaneously available on 
all control units, since the time required to transmit the 
sensor data varies. For example, the time period required 

10 depends on the distance between the transmitting and receiving 
control unit, on the capacity utilization of the data 
transmission medium, or on interference which can degrade the 
data transmission. Due to the requirement for data consistency 
in the control units of the computer system and in order to 

15 allow for the time delay needed to transmit the sensor data, 
the control units of the computer system are operated with a 
time lag, and the computer programs in the control units are 
not executed until after a settable dead time has elapsed 
following the beginning of a time slice. The dead time is 

2 0 utilized for exchanging the sensor data and, possibly, other 

data and information as well, among the control units. The 
time lag is either absolute, i.e., based on a superordinated 
time-slot pattern, is equal in magnitude for all control units 
of the computer system, or is a relative time lag, i.e., a 
25 time lag of individual control units relative to each other. 
Typically, it is a question of a relative time lag between a 
master control unit and slave control units of the computer 
system, as well as among the slave control units. 

In a computer system in which the control units are 

3 0 interconnected via unidirectional data transmission media, 

approximately twice as much time is required for transmitting 
data as in a computer system having bidirectional transmission 
media. The time lag shall now be clarified based on the 
example of a computer system having two control units: Both 
35 control units receive individual (unit-specific) sensor data. 
The first control unit subsequently transfers the data 
received by the sensors to the second control unit. At this 
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point, the sensor data received directly from the sensors, as 
well as the sensor data received from the first control unit 
are available there (at the second control unit) , so that the 
system may already begin with the pending time slice and 
5 execution of the computer program. After receiving the sensor 
data, the second control unit, in turn, transfers the sensor 
data received from the sensors to the first control unit, 
where, at this point, the system may begin with the pending 
time slice and execution of the computer program with a time 
10 delay relative to the first control unit. It is understood 

that the results calculated by the two control units, such as 
drive signals for actuators, must first be buffer-stored in an 
intermediate memory, in order to then be jointly read out and 
used to act on the actuators simultaneously. 

1 5 The exemplary embodiment and/or exemplary method of the 

present invention has, moreover, the advantage that standard 
control units having fewer inputs may be used for controlling 
and/or regulating complex operational sequences, as are 
increasingly required in motor vehicles, for example, in order 

20 to process available sensor data to fulfill the control and, 
respectively, regulating function. By linking the control 
units to the computer system, other additional inputs are 
virtually emulated for the individual control units. By using 
standard control units, the costs may also be kept low for 

25 controlling and/or regulating complex operational sequences as 
well . 

In the case that the sensor data are only available at one 
single control unit, the exemplary embodiment and/or exemplary 
method of the p resent invention also makes it possible to 

3 0 safeguard and ensure the data consistency in that all control 
units of the computer system actually have the same data 
available to them. If the analog sensor data were fed to a 
plurality of control units of the computer system, different 
limits for the A/D- (analog-digital) conversions performed in 

35 the control units could result in different digital values 

being present in the control units for the sensor data, with 
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the result that a data consistency would no longer exist. The 
exemplary embodiment and/or exemplary method of the present 
invention is able to prevent this since each sensor datum is 
only received by one single control unit and is A/D converted 
5 there . 

In accordance with one advantageous embodiment of the present 
invention, the same sensor data are available in the control 
units. Thus, the transfer of the sensor data among the control 
units is carried out in such a way that, following the 
10 transfer of the sensor data, the same sensor data are 

available in their totality in all of the control units. In 
this context, the same sensor data in the various control 
units have identical values. 

Due to the fact that all of the control units run the same 
15 computer programs and perform the same calculations on the 

basis of identical sensor data and, given functional control 
units and, respectively, properly functioning computer 
programs, would have to arrive at the same results, hardware 
and/or software may be used for monitoring for correct 
2 0 functioning. This may be accomplished, for example, by 
comparing the ascertained results or by carrying out a 
redundancy sampling (sampling n from m, n being < m) . 

One preferred □pecific embodiment of the present invention 
provides for each of the control units to receive only one 

2 5 portion of all sensor data from sensors and for the control 

units to exchange sensor data, with the result that all sensor 
data are available in each control unit. In this specific 
embodiment, other additional inputs are virtually emulated for 
the individual control units, so that, in spite of the use of 

30 standard control units (having a limited number of inputs for 
sensor signals) , complex operational sequences may also be 
controlled and/or regulated (while processing more sensor 
signals than one single control unit has inputs) . This enables 
the costs to also be kept low for controlling and/or 

35 regulating complex operational sequences as well. 
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The time lag is advantageously adjusted as a function of the 
time duration required for exchanging the sensor data among 
the control units. The time lag, which the control units 
observe when executing the computer programs, may be set in 
5 advance prior to operation of the computer system. However, 
the time lag io prcf crably may be adjusted during operation of 
the control units, thus during the computer system's run time. 

In accordance with another advantageous embodiment of the 
present invention, the time lag is regulated as a function of 

10 the time duration required for exchanging the sensor data 
among the control units. The regulating process helps to 
ensure that the time lag is always kept as small as possible 
and, on the other hand, however, that the time lag is not 
selected to be too small which could result in the computer 

15 program execution being prematurely started although the 
sensor data are not yet available in all control units. 

In accordance with another advantageous embodiment, the time 
lag is adjusted or regulated in a damped manner as a function 
of the time duration required for exchanging the sensor data 

20 among the control units. The damping process is implemented, 
for example, in that the time lag, respectively a time slice, 
is not shortened until it has become evident multiple times in 
succession that the time lag has actually been set to be too 
long, and that the data transmission was already clearly 

2 5 concluded prior to the time lag elapsing. Thus, not every 
variation in the transmission time leads immediately and 
directly to a variation in the time lag. By implementing this 
measure, the jitter of the transmission time is virtually 
attenuated . 

30 Finally, the exemplary embodiment and/or exemplary method of 
the present invention provides for the control units to be 
synchronized solely by exchanging useful data via the data 
transmission media, without transmitting separate 
synchronization information. Here, it is a question, in 

35 particular, of low-level synchronization. This is a self- 
optimizing time lag between the master and slaves (relative to 



the master) . In contrast, a high-level synchronization is the 
synchronization of the multiplexer for establishing data 
consistency in the computation grids in question (master MUX = 
slave MUX) . In the method of the present invention, it is 
5 conceivable, for example, in addition to the useful data, for 
a time-slice counter (task counter) to be included as 
scheduling information in the messages which are transmitted 
via the data transmission media. 

Starting out from the computer system of the type mentioned at 
10 the outset, another approach for achieving the objective of 
the exemplary embodiment and/or exe mplary method of the 
present invention provides that control units execute the same 
computer program time-synchronously using a time lag that is 
adjustable by ^setting mcana arrangement . 

15 In accordance with one advantageous embodiment, one of the 
control units is defined as a master control unit, and the 
remaining control units are defined as slave control units, 
the master control unit transmitting synchronization 
information to the slave control units. The synchronization 

2 0 information 4-&may likewise prcf crably be transmitted via data 

transmission media. The master control unit specifies a fixed, 
time -synchronous time-slot pattern that the slave control 
units must conform to. The computer programs, which, in 
principle, are the same for the master control unit and the 

2 5 slave control unit, are merely set by a control -unit dongle in 

the cable harness for operation in the master or in the slave. 

In accordance with one preferred embodiment of the present 
invention, once the computer system is booted up, the slave 
control units are automatically synchronized to the time base 
30 of the master control unit. This means that some time (for 
example 10 ms) after the computer system is booted up 
(restart, for example, after the system is switched on or 
after the occurrence of an error) , after the synchronization 
process is concluded, the same time slices are started time- 

3 5 synchronously in the slaves as in the master. However, a 

different time lag may be set in the individual control units, 
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so that the control units may begin executing the computer 
program at different instants, although they work time- 
synchronously . The information required for the 
synchronization is transmitted via the data transmission 
5 media. 

An angularly synchronous time -slot pattern may be superposed 
on the time -synchronous execution of the computer programs, 
thereby making it possible to ensure, for example, that 
calculations that are dependent on the crankshaft angle of 

10 rotation are able to be carried out in any case in a timely 
manner, independently of the time -synchronous time -slot 
pattern. The angularly synchronous time -slot pattern may be 
implemented, for example, by interrupt commands. Messages 
which have been transmitted in the angularly synchronous time- 

15 slot pattern via the data transmission media have an 
especially high priority. 

The exemplary embodiment and/or exemplary method of the 
present invention provides for only one portion of the sensors 
to be connected in each case to the control units, for the 

2 0 control units to receive only a portion of all sensor data in 

each case, and for the control units to exchange sensor data 
via the data transmission medium, with the result that all 
sensor data are available in each control unit. 

Means arc prcfcrably A n arrangement may be provided in the 
25 individual control units which make it possible to hold off on 
executing the computer programs time- synchronously while 
accessing the sensor data, until all up-to-date sensor data 
are available in each control unit. These data must not 
necessarily be the last sensor data to be read in, but may 

3 0 also be the data from an earlier time slice. It is important, 

however, that all available sensor data be equal in age, i.e., 
they come from the same time slice. When the data come from a 
previous time slice, the data processing by the computer 
programs is slightly delayed. In practice, however, this does 
35 not lead to any disadvantages whatsoever, since, typically, it 
is only a question of a delay of a few milliseconds. The 

10 



stability of the controls is ensured in spite of the slight 
time delay. 

In accordance with another advantagcoua embodiment of the 
present invention, each control unit is subdivided into a 
5 hardware level, a hardware driver level, and an application 
software level, the computer program for controlling the 
operational sequences running in the application software 
level, and the sensor data being transmitted independently of 
the application software level in the hardware driver level. 

10 Thus, the exemplary embodiment and/or exemplary method of the 
present invention relates essentially to the hardware driver 
level where the transmitting and receiving via the data 
transmission media, as well as the buffer-storing of the 
sensor data in the control units are implemented. The 

15 application software only accesses the buffer-stored sensor 
data regardless of whether it is a question of sensor data 
received directly from sensors or of sensor data received 
indirectly from other control units via the data transmission 
media. The adjustment and, respectively, control of the time 

20 lag is also implemented in the hardware driver level. 

In contrast, in multicomputer concepts under known methods 
heretofore, it was customary for the individual control units 
of the computer system to be interconnected on the functional 
level, i.e., the master-slave data bus coupling was on the 

25 functional level. The result was that the data bus design was 
heavily dependent on the basic functionality of the system. 
Any change to the application software always necessitated 
adapting the data bus layout. This (disadvantacre) is overcome 
b y the exemplary embodiment and/or exemplary method of the 

3 0 present invention. A stable data bus layout may be ensured 
even when there is a change in the basic functionality. 

In accordance with another preferred opecific embodiment, the 
sensors are assigned to the control units and are linked to 
the control units assigned to them respectively in such a way 
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that, during operation of the computer system, a substantially- 
uniform usage results on the average over time on the data 
transmission medium in both transmission directions. Of 
course, as the number of control units increases, this feature 
5 becomes more difficult to realize. When designing the computer 
system, however, care is taken to ensure that the control 
units transmit sensor data more or less with the same 
frequency that they receive sensor data. If this is not 
followed, the result can be longer transmission times for the 
10 sensor data and a longer time lag than would actually be 
necessary. 

The data transmission via the data transmission medium may 
follow any desired protocols. Conceivable, for example, is the 
use of the FireWire, ByteFlight, FlexRay, of the TTP (time 
15 triggered protocol) or of the LIN (local interconnect network) 
protocol. The data are advantageously transmitted, however, 
via the data transmission medium in accordance with the CAN 
(controller area network) protocol. 

Dricf Dcocription of the Drawing 

20 Other features, possible applications, and advantages of the 
exemplary embodiment and/or exemplar y met hod of the p resent 
invention may be derived from the following description of 
exemplary embodiments of the present invention, which are 
illustrated in the drawing drawings . In this context, all of 

2 5 the described or represented features, alone or in any 
combination, form the subject matter of the exemplary 
embodiment and/or exemplary method of the p resent invent ion , 
regardless of their combination in the claims or their 
antecedents, as well as regardless of their formulation and 

30 representation in the specification and drawing, respectively. 
The figuroo ohow: 

BRIEF DESCRIPTION OF THE DRAWINGS 
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Fig . — ^Figure 1 shows a computer system according to the 
exempl ary embodiment and/or exemplary method of the present 
invention including two control units, which are 
interconnected via a data bus, in accordance with one 
5 preferred specific embodiment^ 

Fig . — 2— Figure 2 shows various theoretical control unit levels 
of a control unit in accordance with the exemplary embodiment 
and/or exemplary method of the p resent invention^ 

Fig ; — 3— Figure 3 shows a system diagram of a computer system 
10 according to the exemplary embodiment and/or exemplary method 
of the present invention including the employed sensor and 
actuator technology in accordance with a first preferred 
opecif ic embodiment^ 

Fig . — 4— Figure 4 shows a finite state machine for synchronizing 
15 the time slices in a slave control unit of the computer system 
according to the exemplary embodiment and/or exemplary method 
of the p resent invention^ 

Fig . — & — Figure 5 shows a computer system according to the 
exemplary embodiment and/or exemplary method of the present 
20 invention for illustrating the message and signal storage-^- ^ 

Fig . — 6 — Figure 6 shows a system diagram of a computer system 
according to the exemplary embodiment and/or exemplary method 
of the present invention including the employed sensor and 
actuator technology in accordance with a second preferred 
2 5 opecif ic embodiment-^ 

Fig . — 7— Figure 7 shows a diagram including the breakdown and 
processing of the time slices in a computer system according 
to the exemplary embodiment and/or exemplary method of the 
present invention-; — aft€ ^ 
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Fig . — 8 — Figure 8 shows signal characteristics in a computer 
system according to the exemplary embodiment and/or e xemplary 
method of the present invention for clarifying the data 
exchange between the master and slave of the computer system. 

5 Detailed Dcocription 

DETAILED DESCRIPTION 

As a prefcrrcd an exemplary embodiment of the present 
invention, reference is made in the following to the control 
of a relatively complex internal combustion engine of a motor 
10 vehicle having ten cylinders. The exemplary embodiment and/or 
exemplary method of the present invention may also be 
utilized, however, for controlling and/or regulating any other 
desired complex operational sequences, prcf crably which may be 
in a motor vehicle. 

15 As illustrated in Figure 1, to control and/or regulate the 

complex operational sequences in internal combustion engine 1, 
a multicomputer system is used, which includes two control 
units 2, 3 that are interconnected via a data transmission 
medium designed as a bus system 4 . The data are transmitted 

20 via bus system 4 in accordance with the CAN (controller area 
network) protocol . 

Control units 2 is defined as a master control unit and the 
other control unit 3 as a slave control unit . Master control 
unit 2 transmits synchronization information to the slave 
25 control unit. The synchronization information is transmitted 
in the form of CAN messages via bus system 4 . Master control 
unit 2 specifies a fixed, time -synchronous time-slot pattern . 
that slave control unit 3 must conform to. 

The same computer programs for fulfilling the normal 
3 0 operational control and/or regulation functions run on both 
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control units 2, 3. The computer programs of the two control 
units 2, 3 essentially process the same input signals, which 
are essentially composed of sensor data SI through S10, as 
well as Sa through Sc and Sx through Sz. Sensor data SI 
5 through S10 come from sensors which are located in the ten 
cylinders Zl through Z10 of internal combustion engine 1. 
Sensor data Sa through Sc, as well as Sx through Sz come from 
other sensors which may be situated in or on internal 
combustion engine 1 or at other locations in the motor 
10 vehicle. 

Since each control unit 2, 3 has only a limited number of 
inputs for connecting sensors, in the computer system 
according to the present invention, a portion of the sensors 
is linked to one control unit 2 and the other portion of the 
15 sensors to other control unit 3 . In order that both control 
units 2, 3 have the same sensor data SI through S10, Sa 
through Sc, Sx through Sz for executing the computer programs, 
the, received sensor data are exchanged between control units 
2, 3 via bus system 4. 

20 As illustrated in Figure 2, control units 2, 3 may be 

theoretically subdivided into a hardware level 5, a hardware 
driver level 6, and an application software level 7. In 
hardware level 5, control units 2, 3 are linked to bus system 
4. The computer programs for controlling internal combustion 

25 engine 1 run in application software level 7 of control units 
2, 3. The transmission of sensor data SI through S10, Sa 
through Sc, Sx through Sz via data bus 4 takes place 
independently of application software level 7 and is 
coordinated in hardware driver level 6. Thus, the computer 

30 programs do not flag whether sensor data SI through S10, Sa 
through Sc, Sx through Sz processed by them were received 
directly from a sensor or indirectly from another control unit 
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2, 3 via bus system 4. In other words, in accordance with the 
exempl ary embodiment and/or exemplary method of the present 
invention, additional inputs for sensor data, which are not 
present as hardware, are emulated in control units 2, 3. 
5 Inputs for sensor data SI through S5 and Sa through Sc are 

realized as hardware in control unit 2 illustrated exemplarily 
in Figure 2, whereas sensor data S6 through S10 and Sx through 
Sz are received via data bus 4; i.e., the inputs for these 
sensor data S6 through S10 and Sx through Sz are emulated. 

10 Thus, a computer system which includes a plurality of simply 
designed and cost-effective standard control units, which are 
interconnected via data transmission media, may also be used 
for controlling and/or regulating tasks of very complex 
operational sequences, which require the processing of a 

15 multiplicity of sensor data. Moreover, the same control unit 
hardware may be used as the master and slave control unit. 

When the various sensor data SI through S10, Sa through Sc, Sx 
through Sz are fed in each case only once to one of control 
units 2,3, then the inventive concept has a further 

20 advantage. This advantage resides in the fact that the data 
consistency is able to be safeguarded and ensured, and that 
all control units 2, 3 of the computer system actually have 
the same data available to them. If analog sensor data SI 
through S10, Sa through Sc, Sx through Sz were fed in parallel 

25 to a plurality of control units 2, 3 of the computer system, 
different limits for the A/D- (analog-digital) conversions 
performed in control units 2, 3 could result in different 
digital values being present in control units 2, 3 for the 
sensor data, with the result that a data consistency would no 

30 longer exist. 

It takes time for sensor data SI through S10, Sa through Sc, 
Sx through Sz to be exchanged via data bus 4 between control 
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units 2, 3. To ensure that all required current sensor data 
are always available in the control units at the particular 
intended time slices, the time slices are started in control 
units 2, 3 using a settable time lag. The time lag observed 
5 when starting a time slice in a control unit 2, 3 depends on 
the required transmission time of the sensor data via bus 
system 4. The time slices in a control unit 3 are started with 
a time lag relative to the start of the time slices in the 
other control unit 2 . 

10 The same computer programs for fulfilling the normal 

operational control and/or regulation functions run in control 
units 2, 3, i.e., the same input signals (for example from the 
sensors) are processed, and the same output signals (for 
example for driving actuators) are determined. In the 

15 exemplary embodiment illustrated in Figure 1, however, only 
the output signals intended for actuators of cylinders Zl 
through Z5 are transmitted from control unit 2 to output 
stages for these actuators (dashed line) , whereas the output 
signals for cylinders Z6 through Z10 remain unused. In the 

2 0 same way, only the output signals intended for actuators of 
cylinders Z6 through Z10 are transmitted from control unit 3 
to output stages for these actuators (dashed line) , whereas 
the output signals for cylinders Zl through Z5 remain unused. 

The master- slave system according to the present invention for 

2 5 the engine control unit concept is designed for a plurality of 

control units 2, 3 which are interconnected via one CAN bus 4. 
Figure 3 shows a system diagram illustrating the sensor and 
actuator technology used which is identical to the sensor and 
actuator technology used in a second design (compare Figure 

3 0 6) . In the first concept according to the exemplary embodiment 

and/or exemplary method of the p resent invention, as 
illustrated in Figure 3, master control unit 2 and slave 
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control unit 3 are identical in design. The software used in 
the two control units 2, 3 is identical. Moreover, both 
control units 2, 3 are virtually identical in terms of 
function. They both fulfill the functions listed exemplarily 
5 in the following: 

reference numeral 8 : 
signal inputs 
sensor evaluation 
signal processing 
10 - atmospheric -pressure sensor, only master control unit 2 

reference numeral 9: 
starting torque 
idle-speed control 
torque control and limitation 
15 - external torque intervention 
engine -smoothness regulator 
act i ve surge damper 

calculation of start of pump delivery and of delivery 
period 

20 - start-of -delivery correction (begin of injection period 
(BIP) ) 

boost -pressure control 

exhaust gas recirculation and throttle valve control 

exhaust gas af tertreatment 
2 5 - fuel cooling control 

vehicle-speed controller or cruise control 

engine mount control 

air-conditioner compressor control 

glow-time control 
30 - vehicle immobilizing system 

substitution functions 

adjustment 
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after running 



reference numeral 10: 

solenoid-valve final stages 

reference numeral 11: 
5 - power output stages 

reference numeral 12 : 
diagnostic 

serial interface (only master control unit 2) 
angular clock coupling (only slave control unit 3) 
10 - CAN communication 

The sensors listed exemplarily in the following supply sensor 
data to master control unit : 
13.1: engine speed 

13.2: engine speed (camshaft) and cylinder sensing 
15 - 13.3: pedal-force sensor including low-idle switch and 
kickdown (forced downshift) (optionally second pedal - 
force sensor) 

boost pressure 
air temperature 
fuel temperature 
oil temperature 
water temperature M 
exhaust -gas temperature % 
13.10: air mass 
25 - 13.11: vehicle speed 

13.12: GRA controller (cruise controller) 
13.13: brake (2) 
13.14: clutch 
13.15: terminal 50 
30 - 13.16: sheathed-element glow plug feedback signal 
13.17: crash sensor 



13 .4 
13.5 

20 - 13.6 
13 .7 
13.8 
13 . 9 
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13.18: low-idle (fuel-tank empty) switch 

13.19: tank cap open 

13.20: auxiliary heater demand 

13.21: auxiliary heater consumption signal 

5 - 13.22: heat demand 

13.23: rapeseed methyl sensor 

13.24: particulate-f ilter differential pressure 

13.25: lambda probe 

13.26: generator load 

10 - 13.27: air-conditioning control 

The sensors listed exemplarily in the following supply sensor 
data to slave control unit 3 : 

14.4: boost pressure 

14.5: air temperature 
15 - 14.6: fuel temperature 

14.9: exhaust -gas temperature M 

14.10: air mass 

14.16: sheathed-element glow plug feedback signal 
14.24: particulate-f ilter differential pressure 
20 - 14.25: lambda probe 

Sensor data 15 (terminal 15) are available at both control 
units 2 , 3 . 

Via solenoid-valve final stages 10, control units 2, 3 control 
the start of pump delivery and/or the delivery period of fuel 

25 injectors 16. These injectors are designed, for example, as 
pump-nozzle units or as common-rail injectors. As already 
mentioned above, control unit 2 drives fuel injectors 16 of 
cylinders Zl through Z5, whereas control unit 3 drives those 
of cylinders Z6 through Z10. This has the advantage that, for 

30 each control unit 2, 3, it is not necessary to operate all, 
but merely five solenoid-valve final stages. This makes it 
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possible to reduce the waste heat generated in control units 
2, 3 by the final stages. 



Via power output stages 11, control unit 2 drives actuators 
for the functions listed exemplarily in the following: 
5 - 16.1: engine mounts 

16.2: fuel tank shut -off valve 

16.3: start controller M 

16.4: generator shutoff 

16.5: air-conditioner demands 
10 - 16.6: radiator cooling fan 

16.7: radiator thermostatic control 

16.8: fuel cooling 

16.9: fuel -pump relay 

16.10: fan control 
15 - 16.11: glow plug relay 

16.12: electrical cooling-water pump 

16.13: catalyst heating 

16.14: additive metering pump 

16.15: auxiliary heater relay M 
20 - 16.16: auxiliary-heater burner control 

16.17: throttle-valve actuator 

16.18: exhaust gas recirculation positioner 

16.19: exhaust gas recirculation cooling 

16.20: boost-pressure controller 
25 - 16.21: sheathed-element glow plug control unit 

Via power output stages 11, control unit 3 drives actuators 
for the functions listed exemplarily in the following: 



30 



17 . 


11 : 


glow plug relay 




17 . 


13 : 


catalyst heating 




17 . 


17 : 


throttle -valve actuator 




17 . 


18 : 


exhaust gas recirculation 


positioner 


17 . 


19 : 


exhaust gas recirculation 


cooling 
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17.20: boost -pressure controller 

17.21: sheathed-element glow plug control unit 

Via a CAN data bus 4, data from a control unit of a traction 
control system / engine-drag-torque control 18.1, as well as 
5 from a control unit of a transmission 18.2 are fed to master 
control unit 2 . 

In addition, signals are output by control unit 2 to the units 
mentioned exemplarily in the following: 

19.1: diagnosis interface (ISO K) having a switching 
10 x element for triggering a diagnostics request 

19.2: system lamp 

19.3: MIL lamp (malfunction indicator lamp, trouble 
localizer light for onboard diagnostics) 
19.4: speed coupling 
15 - 19.5: speed indication (speed signal) 

19.6: fuel -consumption indicator (fuel -consumption 
signal) 

In the case of control unit 3, an appropriate diagnosis 
interface (ISO K) 20.1 having a switching element for 
20 triggering a diagnostics request is provided. 

In addition, data buses 4 are provided for a data exchange 21 
between control units 2, 3. The data exchange is limited to 
sensor-signal raw values, digital signals, error statistics, 
controller values, and control statistics. Exchanged in 
25 particular are: 

digital sensor data (following the A/D conversion of the 
analog sensor data fed by sensors 13, 14 to control units 
2, 3) 

controller adjustment information 
30 - control status information 

program synchronization information. 
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A primary relay of the motor vehicle is denoted in Figure 3 by 
reference numeral 22, the motor vehicle battery by 23. 

For the most part, sensor system 13, 14 is linked to master 
control unit 2. Because of the completely dual -branch air and 
5 exhaust system of internal combustion engine 1, the signals, 
such as air mass 13.10, 14.10, air temperature 13.5, 14.5, 
boost pressure 13.4, 14.4, exhaust -gas temperature 13.9, 14.9, 
etc. are available separately at master 2 and slave 3. At the 
same time, however, these dual signals are consistently 

10 exchanged with each other, so that each control unit also has 
access to the input data of the other corresponding air 
branch. Moreover, a mechanism was developed for the dual 
sensor system's data exchange to enable a control unit 2, 3 to 
access the air mass, for example, and to automatically receive 

15 the air mass measured by sensor 13.10, 14.10 directly 
connected to control unit 2, 3. Via the access to the 
"external air mass", the air mass of other control unit 2, 3 
that the control unit receives indirectly via data bus 4, is 
automatically accessed. In this way, equivalent reactions may 

2 0 be initiated synchronously in response to errors. Many sensors 
13, 14, such as sheathed-element glow plugs 13.16, 14.16, are 
only detected locally in each control unit 2, 3 and are not 
exchanged, since they are of secondary importance to the 
entire system. 

25 The time -synchronous calculations are initiated in master- 
control unit 2 . This unit records the corresponding sensor 
data and transfers a portion of this raw sensor data, to slave 
control unit 3. However, for reasons of data consistency, for 
the pending calculation, the unit utilizes the sensor data 

30 from the preceding, already adjusted time slice. Due to the 
substantial data volume, not all signals are able to be 
transmitted at once. The transfer is carried out as a packet 
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transmission (for example, always five or six CAN messages) 
every 10 ms from master 2 to slave 3 and vice versa. Of 
course, any other time-slot pattern may also be used. 

If a data packet has been completely transferred to slave 3, 
5 then a finite state machine recognizes this and starts the 
same time slice as in master 2. The finite state machine is 
used for synchronizing the time slices in slave 3 and is 
illustrated in Figure 4 . The information regarding which time 
slice is being calculated at the moment is contained in each 

10 CAN transmission packet. The received data are buffer-stored 
in an intermediate memory, the so-called shadow buffer 
(compare reference numeral 51 in Figure 5) ; the current time 
slice is calculated using identical data as master 2, stored 
in a so-called RAM mirror. The reason for the buffer storage 

15 is data consistency within the time slices and the relatively 
large data volume of one time slice. If calculation of a time 
slice is complete, the data exchange for the next time slice 
must be completed before it is started. As a result of this 
time expenditure for the consistent data exchange, a 

2 0 measurable dead time (delay) is built into the system. The 

signals are all delayed by one time slice, but are absolutely 
identical in the system. 

In the case of the finite state machine illustrated in Figure 
4 for synchronizing the time slices in slave 3, after the 

25 computer system is restarted (for example after being turned 
on or following an error) , a first state 30 (initialization) 
is begun. From there, the transition is made to a state 31 
(period elapsed, wait for CAN) . When the delay time has 
elapsed, without data being received from data bus 4 

30 (condition 32), the transition is made to a state 33 (forced 

scheduling) . A blocking time is then defined in a step 34, and 
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the transition is made to a state 35 in which no data are read 
from data bus 4. Step 34 may be implemented, for example, by: 
debounce counter -- 
if debounce counter = 0 
5 {period = prolonged 

reload debounce counter 
} else 

{period = normal} 
blocking time = period - delay time 
10 Alternatively, the blocking time may also be calculated as the 
sum of the period and delay time. During the blocking time, no 
data are received from data bus 4 . Finally, the transition is 
made again to state 31 (period elapsed, wait for CAN) , as soon 
as the blocking time has elapsed (condition 36) . A blind 
15 window is quasi defined by the blocking time and pushed 

through the time- slot pattern by shortening or lengthening the 
time slices, until the time-slot pattern of slave 3 conforms 
with that of master 2, and the same time slices are executed 
time- synchronously in master 2 and slave 3 (to all intents and 
20 purposes, however, with the time lag mentioned above) . The 
blocking time (the blind window) is used to improve the 
interference immunity of the synchronization of control units 
2, 3. During the blocking time, no data may arrive via bus 4. 
Thus, any unnecessary shortening of the time slice is 
2 5 prevented. 

When, in state 31, data are received from data bus 4 during 
the delay time (condition 37, CAN object newData) , the 
transition is made to a state 38 (start schedule) . From there, 
in a step 39, the transition may be made to a state 40 
30 (schedule blocked) . Step 39 may be implemented, for example, 
by: 

if debounce counter = 0 
{period = shortened 
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blocking time = blocking time for shortened period 
debounce counter = debounce counter for shortening 
} else 

{period = normal 
5 blocking time = blocking time for normal period) 

In state 40, a blind window is quasi defined, in the case that 
an error occurs. A decision is made as to whether the period 
is shortened. In the case that a condition 41 (blocking time 
elapsed, CAN up-to-date and debounce counter --) is fulfilled, 

10 the transition is made to a state 42 (CAN up-to-date, wait for 
end of period). In state 42, however, slave 3 is not scheduled 
to observe data bus 4, rather it flags if a CAN message had 
been completely received at an earlier point in time (i.e., 
prior to expiration of the time delay) . If the period is 

15 elapsed (condition 43) , slave 3 makes the transition again to 
state 38. If all messages were not yet received in state 42, 
due to excessive shortening of the period (condition 44, 
period expired, CAN old, debounce counter = debounce counter 
for lengthening), the system reverts to state 31. If a 

20 condition 45 (blocking time expired, CAN old and debounce 

counter = debounce counter for shortening) is fulfilled, slave 
3 changes to a state 46 (wait for end of period) , where the 
period is shortened. If all messages were received (condition 
47, period expired, CAN up-to-date, debounce counter = 

25 debounce counter for shorten), slave 3 reverts to state 38. If 
all messages were not yet received, due to excessive 
shortening of the period (condition 48, period expired, CAN 
old, debounce counter = debounce counter for lengthening) , the 
system reverts to state 31. 

30 Thus, in summary, it can be said about the finite state 

machine from Figure 4 that : Master control unit 2 specifies 
the time-slot pattern, i.e., it indicates which number time 
slice should be started by slave control unit 3. If the 
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numbers of the time slices of master 2 and slave 3 pending 
execution differ, the time slices of slave 3 are shortened or 
lengthened to a greater or lesser extent, and the computer 
system is operated with time slices which vary in length, 
5 until the numbers of the time slices of master 2 and slave 3 
are identical . 

A special data synchronization strategy is used during the 
initialization between master 2 and slave 3. During the 
initialization process, analog values are measured. These 

10 values are used to initialize a PT1 filter. In a master-slave 
computer system, the problem arises that the component drivers 
access values that are buffer-stored in the read-write memory 
(RAM mirror) . During the initialization, this read-write 
memory does not yet contain any valid values. Thus, the PT1 

15 filter is initialized incorrectly. 

For that reason, during initialization, the following strategy 
is used for purposes of signal acquisition: 

a) During the initialization routine, a request bit is set in 
the status register for all signals contained in the data 

2 0 sets. Thus, in any case, hardware is accessed in response 

to the first invoking (call) of the component driver. This 
first valid signal value is stored in accordance with the 
computer system in the intermediate memory (shadow 
buffer) . The component driver utilizes the incorrect value 

25 from the read- write memory. 

b) Equalization of the signals of the initialization task 
(reference numeral 30 in Figure 3) : Task 30 has a task 
counter 10. It is only executed in response to control 
unit reset. In a signal initialization process, master 2 

30 and slave 3 send the CAN data of initialization task 30. 

This process is carried out at the end of the 
initialization to ensure that all hardware accesses of the 
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initialization are complete, thus that the intermediate 
memory is filled with valid values. After sending the data 
of initialization task 30, master 2 and slave 3 wait to 
receive the data packet. The maximum delay time may be 
applied via a label. Immediately after receipt, the data 
are decoded and thus stored in a separate intermediate 
memory. (This code section is run through nearly 
simultaneously in master 2 and slave 3. Here, a 
synchronization of the time bases is possible in master 2 
and slave 3.) At this point, each control unit 2, 3 has 
all signal values that are valid for the initialization 
stored in the intermediate memory. 

c) Updating the signals of initialization task 30: copying 
the signal values from the intermediate memory into the 
read- write memory. 

d) Invoking the initialization process of the signals which 
initialize the PT1 filter in the initialization. 

e) Normal operation of the computer system during vehicle 
operation of the internal combustion engine (drive mode) . 

If master 2 executes a reset during vehicle operation, it runs 
through the initialization (compare above) and sends the data 
packet of initialization task 30 to CAN bus 4. Slave 3 
receives the data packet. The time -synchronous scheduling 
process does not start any task, but sends the data packet to 
CAN bus 4. Following evaluation of this data packet, master 2 
continues its initialization; compare point c) above. 

If slave 3 executes a reset during vehicle operation, it runs 
through the initialization (compare above) and sends the data 
packet of initialization task 30 to CAN bus 4. Master 2 
receives the data packet. In the time -synchronous master-slave 
component driver starting process, it recognizes the data 
packet request from slave 3, and does not send the data of the 
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current task, but rather the data of initialization task 30. 
Following evaluation of this data packet, slave 3 continues 
its initialization; compare point c) above . 

The storing of messages and signals in the computer system 
5 according to the present invention is clarified with reference 
to Figure 5. In master control unit 2, sensor data 13 from 
relevant hardware (sensors 50) are fetched and buffer- stored 
in the intermediate memory (shadow buffer 51) . To update 
sensor data 13 utilized for calculation purposes in master 2 

10 in the subsequent time slice, to the updated status, current 
sensor data 13 are copied from intermediate memory 51 into a 
read-write memory (RAM mirror 52) . From this memory, they are 
then read out, as needed, by computer programs 54 running on 
master 2 and used for calculations (step 55) . Moreover, 

15 updated sensor data 13 are read out from intermediate memory 
51 and buffer-stored (step 57) in a message memory (message 
buffer 56) . From there, they are then transmitted via a dual 
port RAM 58 and data bus 4 to slave control unit 3. 

In slave 3, updated sensor data 13 from master 2 are buffer- 
20 stored via a dual port RAM 59 in a message memory (message 

buffer 60) . From there, sensor data 13 are then transferred in 
a step 61 into an intermediate memory (shadow buffer 62) . To 
update sensor data 13 utilized for calculation purposes in 
slave 3 in the subsequent time slice, to the updated status, 
25 current sensor data 13 received from master 2 are copied from 
intermediate memory 62 into a read-write memory (RAM mirror 
63) . From this memory, they are then read out, as needed, by 
computer programs 65 running on slave 3 and used for 
calculations (step 66) . 

30 Moreover, in slave control unit 3, sensor data 13 from 

relevant hardware (sensors 67) are fetched and buffer-stored 
in intermediate memory (shadow buffer) 62. To update sensor 
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data 13 utilized for calculation purposes in slave 3 in the 
subsequent time slice, to the updated status, current sensor 
data 13 are copied from intermediate memory 62 into read-write 
memory 63 (step 64) . From this memory, they are then read out, 
5 as needed, by computer programs 65 running on slave 3 and used 
for calculations (step 66) . Moreover, updated sensor data 13 
are read out from intermediate memory 62 and buffer- stored 
(step 68) in a message memory (message buffer) 60. From there, 
they are then transmitted via dual port RAM 59 and data bus 4 
10 to master control unit 2. 

In master 2, updated sensor data 13 from slave 3 are buffer- 
stored via a dual port RAM 58 in message memory (message 
buffer) 56. From there, sensor data 13 are then transferred in 
a step 69 into intermediate memory (shadow buffer) 51. To 

15 update sensor data 13 utilized for calculation purposes in 

master 2 in the subsequent time slice, to the updated status, 
current sensor data 13 received from slave 3 are copied from 
intermediate memory 51 into read-write memory 52 (step 53) . 
From this memory, they are then read out, as needed, by 

2 0 computer programs 54 running on master 2 and used for 
calculations (step 55) . 

While sensor data 13 of the current time slice (processed at 
instant n) are stored in intermediate memories 51, 62, the 
actual execution of computer programs 54, 65 takes place on 

25 the basis of sensor data 13 of the preceding time slice 

(processed at instant n-1) . From application software level 7, 
computer programs 54, 65 send requests 70, 71 for new values 
for sensor data 13 to hardware driver level 6. The execution 
of the above described sequences involving steps 50 through 6 9 

30 goes unnoticed by application software level 7. It merely 

registers new values for sensor data 13 being communicated to 
it in steps 55 and 66. It is unimportant to application 
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software level 7 where, precisely, the data come from and 
whether it is a question of current data or of data of the 
preceding time slice. 

To ensure a correct data exchange between master 2 and slave 
5 3, three different signal/message intermediate memories are 
required (compare Figure 5) : 

MS message buffer 56, 60: for buffer-storing complete CAN 

messages 

Shadow buffer 51, 62: for buffer-storing individual 

10 signals, until all signals of a 20 ms/100 ms 

time slice are exchanged. Within the framework 
of receiving messages, sending messages, and 
up-dating the RAM mirror, the shadow buffer is 
accessed exclusively via the master slave 
15 driver. 

RAM mirror 52, 63: contains all signals used for the current 

calculations. Signal accesses are made to this 
buffer instead of to the hardware (for example, 
A/D converter) . 

2 0 To ensure data consistency already during run-up of control 

units 2, 3, a special strategy was developed for synchronizing 
selected data prior to the actual start of the computer 
program. It is advantageous in this context for a very 
particular instant to be executed simultaneously (in the 100 

2 5 microsecond range) in the computer program of master 2 and 
slave 3. This makes it possible for the time bases of 
individual control units 2, 3 to be adjusted. Thus, for 
example, glow-plug control signals in master 2 and slave 3 may 
be precisely interleaved in order to minimize drops in the 

30 battery voltage. 
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Besides the sensor data, any data at all from the application 
software may be included as so-called user signals in this 
signal exchange. However, these signals are not buffer-stored 
in order not to unnecessarily degrade their timeliness (up-to- 
5 date status) . Depending on the selection of the transmission 
instant, these signals may also be used identically in the 
master and slave time slice. 

It is possible to shift sensors or actuators to the other 
control unit while expending relatively little outlay for 
10 changing the configuration, since all actuator values in both 
control units 2, 3 are calculated, and the output stage errors 
are coupled. 

The security concept of the master slave system will not be 
discussed in greater detail at this point. A few key points 
15 are merely listed exemplarily in the following: 
CAN bus hardware monitoring; 

CAN bus data monitoring for receiving and sending; 
CAN bus data monitoring using the checksum -(-method-)- for a 
complete data packet; 
2 0 - monitoring the correct time slice sequence in each 
control unit 2, 3; 

monitoring the correct time slice sequence of slave 3 by 
master 2 ; and 

recognizing a control unit reset during operation by the 
2 5 other control unit. 

Both control units 2, 3 execute the same computer program 
synchronously with a settable time lag and are able to access 
the same sensor data 13. Thus, in these respects, it is 
actually a master-master design. 

30 Figure 6 shows a system diagram illustrating another exemplary 
embodiment of the computer system according to the present 
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invention, including the sensor and actuator technology used. 
In comparison to the exemplary embodiment shown in Figure 3, 
in the exemplary embodiment illustrated here, missing in 
master 2 is a sensor 13.7 for measuring the oil temperature, a 
5 sensor 13.9 for measuring the exhaust-gas temperature, as well 
as a sensor 13.16 for the glow element feedback signal, a 
crash sensor 13.17, a low-idle (fuel-tank empty) switch 13.18, 
a switch 13.19 for indicating the status (open, closed) of the 
fuel-tank cap, a switch 13.20 for indicating a request for 

10 auxiliary heating, a sensor 13.21 for the auxiliary heater 

consumption signal, a sensor 13.22 for heat demand, a rapeseed 
methyl sensor 13.23, a sensor 13.24 for the differential 
pressure in the particulate filter, and a lambda probe 13.25. 
In addition, in the exemplary embodiment shown in Figure 6, a 

15 switch 13.28 is provided for a MIL (malfunction indication 
lamp) request and a switch 13.29 for the status of a time- 
delay relay for preheating. In the case of slave 3, a sensor 
14.9 is missing for the exhaust-gas temperature, as well as a 
sensor 14.16 for the glow element feedback signal, a sensor 

20 14.24 for the differential pressure in the particulate filter 
and a lambda probe 14.25. 

The actuators, which are driven by master 2 via power output 
stages 11, do not include a fuel tank shut -off valve 16.2, a 
start controller 16.3, a generator shutoff 16.4, an air- 

25 conditioner demand 16.5, a radiator thermostatic control 16.7, 
a fan control 16.10, an electrical cooling-water pump 16.12, a 
catalyst heating 16.13, an additive metering pump 16.14, a 
supplemental relay 16.15, an auxiliary-heater burner control 
16.16, an exhaust gas recirculation cooling 16.19 or a 

30 sheathed-element glow plug control unit 16.21. Provided, 
instead, are actuators for a radiator fan bypass/shut-off 
relay 16.22, a replenishing pump 16.23, a radiator- fan charge 
air 16.24, a hydraulic radiator fan 16.25, a radiator 



33 



thermostat heating 16.26, and an air-conditioner shutoff 
16.27. The actuators, which are driven by slave 3, do not 
include a glow plug relay 17.11, a catalyst heating 17.13, an 
exhaust gas recirculation cooling 17.19 or a sheathed-element 
5 glow plug control unit 17.21. The data (reference numeral 21) 
transmitted via data bus 4 between master 2 and slave 3 
relate, in particular, to the volume, i.e., the trailing- 
throttle status, a cylinder counter, a control status, as well 
as input variables for exhaust gas recirculation and boost - 
10 pressure* control . 

Functions 9 of master 2 do not include any exhaust gas 
af tertreatment and, instead of a starting torque, a starting- 
fuel quantity is considered. Functions 9 of slave 3 do not 
relate to the starting torque, the idle-speed control, the 

15 torque control and limitation, the external torque 

intervention, the engine- smoothness regulator, the active 
surge damper, the exhaust gas af tertreatment , the fuel cooling 
control, the vehicle-speed controller (cruise control), the 
engine mount control, the air-conditioner compressor control, 

20 the glow-time control or the vehicle immobilizing system. 

Although the functional scopes of master 2 and slave 3 in the 
exemplary embodiment illustrated in Figure 6 are relatively 
substantially distinguished from one another, the same 
computer programs still run in both control units 2, 3, in 

25 slave 3, not all values calculated by the computer programs 
being used for driving actuators 17 or for fulfilling the 
control and/or regulation function. However, this does not 
change the fact that, in the computer system of Figure 6 as 
well, the same computer programs are executed time- 

3 0 synchronously in master 2 and slave 3 with a settable time 

lag, and that the same sensor data are available in master 2 
and slave 3 . 
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The errors for sensors 13, 14 and actuators 16, 17 are stored 
separately in master 2 and slave 3 . The stored information 
pertaining to the occurrence of an error may be exchanged and, 
respectively, synchronized between master 2 and slave 3. 
5 However, information pertaining to the circumstances of the 

error (such as when, what, where) remain in the error memories 
and is not synchronized. To be able to read out the error 
memories via diagnosis interfaces 19.1, 20.1 for maintenance 
purposes, the error memories must be addressable via different 
10 addresses (so-called wake-up addresses) . This is necessary 
since the software of master 2 and of slave 3 is otherwise 
identical. The error memories may be read out via diagnosis 
interfaces 19.1, 20.1, for example, via a CAN bus (KWP2000) or 
via a serial interface (K line) . 

15 In the master-slave systems described exemplarily in the 

figures, two control units 2, 3 are interconnected via a CAN 
bus 4. Sensors 13, 14 are only partially linked to one control 
unit 2, 3. Thus, while maintaining the data consistency, the 
sensor data must be transmitted within the time -synchronous 

2 0 tasks from one control unit 2 ; 3 to the other control unit 3 ; 
2 . 

The data multiplexing of the CAN messages is carried out using 
data identifiers (data IDs) . The messages used for equalizing 
sensors 13 in the master-slave system have the following 
25 structure : 



CAN ID 



data ID 


data 


data 


data 


data 


data 


data 


data 



The time -synchronous message transmission is carried out in 
the present exemplary embodiments in a 10 ms pattern. 
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In the process, a block of CAN messages is always exchanged 
between control units 2, 3. The end of the block and thus the 
end of the data transmission is recognized by way of a defined 
CAN identifier. This CAN identifier is sent exclusively as the 
5 last message in the CAN transmission block. The last CAN 
message has the following structure: 



CAN ID 



data ID 


CS 


task 


data 


data 


data 


data 


data 






counter 













Data ID: 
10 CS : 

Task counter: 



multiplexing information 

check sum of all message bytes of a 

transmission block 

scheduling information / time-slice 
counter 



An example of a CAN transmission block: 



15 



transmission 
sequence 


CAN ID 


message 
contents 


multiplexing 
between the 10 
ms tasks 


1 


401 


data 


yes 


2 


402 


data 


yes 


3 


403 


data 


yes 


last 


404 


CS, task 
counter, data 


yes 
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In the exemplary embodiments described above, the 2 0 ms tasks 
(MS_Task20) and the 100 ms tasks (MS_Taskl00_0 through 
MS__Taskl0 0_9) in both control units 2, 3 are subdivided into 
10 ms parts (time slots 70, 71) and scheduled in the 10 ms 
time-slot pattern. This means that, after 20 ms, all parts of 
the 20 ms task and, after 100 ms, all parts of the 100 ms task 



36 



are carried out (compare the breakdown and processing of the 
time slices in Figure 7) . Master control unit 2 sends CAN 
messages every 10 ms in order to transfer the measured sensor 
data 13 of master control unit 2 to slave control unit 3 . In 
5 this CAN transmission, the information on which time slice in 
master 2 is currently being executed, is transmitted along 
with the other information in the form of a counter (task 
counter) . This number of the current time slice that is sent 
along is indicated within the 100 ms tasks (MS_Taskl00_0 

10 through MS_Taskl0 0_9) (#i, i = 0 through 9) . Slave control 
unit 3 synchronizes the start of its 10 ms task using the 
finite state machine illustrated in Figure 4. Slave control 
unit 3 transfers the counter for the current 10 ms time slice 
to master control unit 2. In this manner, the master is able 

15 to monitor the sequence of the time slices in slave 3. 

The data exchange in the master- slave system is explained in 
greater detail with reference to Figure 8 . Sensor data xl 
through x5 are processed as input signals in the computer 
programs of master 2 and slave 3, sensor data xl and x2 being 

2 0 directly available at master 2 and sensor data x3 through x5 
being directly available at slave 3. n denotes the time base 
of the 20 ms task; m the time base of the 100 ms task. Sensor 
data xl through x4 are processed in the 2 0 ms task, whereas 
sensor data x5 are processed in the 100 ms task. Reference 

25 numeral R in Figure 8 signifies that a data-update request bit 
is set. In Figure 8, master 2 is shown in the top half and 
slave 3 in the bottom half. 

In a time slice n, data are initially processed in a 10 ms 
time slot #8 (reference numeral 81) , and then in a 10 ms time 
30 slot #9. At the beginning of a time slot 81, a master-slave 
starting procedure 82 is executed, as well as a master-slave 
transmitting procedure 83 for data transmission. 
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In time slot #8, intermediate memory 51 of master 2 contains 
sensor data xl (n) and x2 (n) of the current 20 ms time slice n. 
Moreover, it contains sensor data x3(n-l) and x4 (n-1) of the 
preceding 20 ms time slice n-1. Sensor data x4 (n-1) were 
5 transmitted in the preceding time slice n-1 from slave 3 to 
master 2 and stored there in intermediate memory 51. Finally, 
intermediate memory 51 also contains sensor data x5(m-l) of 
the preceding 100 ms time slice m-1. In addition, in time slot 
#8, read-write memory 51 of master 2 contains sensor data 
10 xl(n-l), x2(n-l), x3(n-l), x4(n-l) of the preceding 20 ms time 
slice n-1, as well as sensor data x5(m-l) of the preceding 100 
ms time slice m-1. 

The computer programs in slave 3 are executed in time slices 
time -synchronously with a settable time lag 80 relative to 
master 2 . Intermediate memory 62 of slave 3 contains sensor 
data xl (n) , x3 (n) and x4 (n) in time slice n that is delayed by 
time lag 80, data x3 (n) and x4 (n) being directly available at 
slave 3 . Sensor data xl (n) were transmitted during time lag 80 
in a CAN message from master 2 to slave 3 and stored there in 
intermediate memory 62 . In addition, intermediate memory 62 
contains sensor data x2 (n-1) of the preceding 20 ms time slice 
n-1, as well as sensor data x5 (m) of the current 100 ms time 
slice m. Values xl (n-1) , x2 (n-1 ) , x3 (n-1) , x4 (n-1) and x5 (m-1) 
of the preceding time slices n-1, m-1 are still stored in 
read-write memory 63 . Current sensor data x3 (n) and x5 (m) , 
that slave 3 had just read in from sensors 13, are transmitted 
from slave 3 to master 2 and stored there in intermediate 
memory 51. 

In time slot #9, current sensor data x2 (n) , that master 2 had 
30 just read in from sensors 13, are transmitted in a CAN message 
to slave 3. In the same way, current sensor data x4 (n) , that 
slave 3 had just read in from sensors 13, are transmitted in a 
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CAN message to master 2. Thus, all current sensor data xl (n) 
through x4 (n) and x5 (m) are available in both control units 2, 
3. In subsequent time slice n+1, current sensor data are 
transmitted into read-write memories 52, 63 of master 2 and of 
5 slave 3, where they are available for execution of the 
computer programs . 

Moreover, in time slice n+1, current sensor data xl(n+l), 
x2(n+2) are again read in from master 2 and current sensor 
data x3 (n+1) , x4 (n+1) from slave 3 directly from sensors 13 

10 and transmitted in time slots #0 and #1 via CAN data bus 4 to 
the respective other control unit 3; 2, so that, at subsequent 
time slot n+2 , current sensor data xl (n+1) through x4 (n+1) , as 
well as x5 (m) are available for execution of the computer 
programs. Sensor data x5 are read in only in every fifth time 

15 slice from slave 3, thus, the next time, again in time slice 
n+5 . 
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Abo tract A BSTRACT OF THE DISCLOSURE 

A method and a computer system for operating at least two 
interconnected control units — (-2-7 — 3-)-- The control units — (-2-7 — 3-)- 
access sensor data (xl , — — 3^5-) — and each execute at least one 
5 computer program for controlling operational sequences, in 
particular in a vehicle. The control units 42-7 — 3-) — exchange 
synchronization information with one another. In order to 
design and refine a computer system in a way that will enable 
even especially complex operational sequences, as required in 

10 a modern motor vehicle, for example, to be controlled and/or 
regulated simply and cost-effectively with the aid of the 
computer system, using conventional control units — (-2-7 — 3-)-, -arfe- 
is proposed that the control units — (-2-? — 34- execute the same 
computer program time -synchronously using a settable time lag 

15 (80) . (Figure 8) 
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